CVE-2019-15700

public/js/frappe/form/footer/timeline.js in Frappe Framework 12 through 12.0.8 does not escape HTML in the timeline and thus is affected by crafted "changed value of" text.

Score

CVSS 3.0 6.1 Medium

Status

Modified - cve@mitre.org

Published

2019-08-27

Last modified

2024-08-05

Weaknesses

CWE-79

Affected products

• Frappe (Frappe)

References

• https://github.com/frappe/frappe/pull/8262